IsolationAssetWrapper
This is a wrapper to isolate or unisolate hash lists from Cortex XDR, MSDE or CrowdStrike (Available from Cortex XSOAR 6.0.0).
python · Common Scripts
Details
| ID | IsolationAssetWrapper |
|---|---|
| Language | python |
| From Version | 6.0.0 |
| Docker Image | demisto/python3:3.12.13.10404775 |
| Tags | basescript incident-action-button |
README
This is a wrapper to isolate or unisolate hash lists from Cortex XDR, MSDE or CrowdStrike (Available from Cortex XSOAR 6.0.0).
Script Data
| Name | Description |
|---|---|
| Script Type | python3 |
| Tags | basescript |
| Cortex XSOAR Version | 6.0.0 |
Inputs
| Argument Name | Description |
|---|---|
| device_ids | Device IDs to isolate or unisolate. |
| action | The action to apply to device IDs - isolate or unisolate. |
Outputs
| Path | Description | Type |
|---|---|---|
| MicrosoftATP.MachineAction.ID | The machine action ID. | String |
| MicrosoftATP.MachineAction.Type | The type of the machine action. | String |
| MicrosoftATP.MachineAction.Scope | The scope of the action. | Unknown |
| MicrosoftATP.MachineAction.Requestor | The ID of the user that executed the action. | String |
| MicrosoftATP.MachineAction.RequestorComment | The comment that was written when issuing the action. | String |
| MicrosoftATP.MachineAction.Status | The current status of the command. | String |
| MicrosoftATP.MachineAction.MachineID | The machine ID on which the action was executed. | String |
| MicrosoftATP.MachineAction.ComputerDNSName | The machine DNS name on which the action was executed. | String |
| MicrosoftATP.MachineAction.CreationDateTimeUtc | The date and time the action was created. | Date |
| MicrosoftATP.MachineAction.LastUpdateTimeUtc | The last date and time the action status was updated. | Date |
| MicrosoftATP.MachineAction.RelatedFileInfo.FileIdentifier | The file identifier. | String |
| MicrosoftATP.MachineAction.RelatedFileInfo.FileIdentifierType | The type of the file identifier. Possible values: “SHA1” ,”SHA256”, and “MD5”. | String |
| PaloAltoNetworksXDR.Isolation.endpoint_id | The endpoint ID. | String |
| PaloAltoNetworksXDR.UnIsolation.endpoint_id | Isolates the specified endpoint. | String |
Script Examples
Example command
!IsolationAssetWrapper action=unisolate device_ids=15dbb9d8f06b45fe9f61eb46e829d986,046761c46ec84f40b27b6f79ce7cd32c
Context Example
{
"MicrosoftATP": {
"MachineAction": {
"Status": "Pending",
"Commands": [],
"CreationDateTimeUtc": "2022-03-27T10:14:29.9635187Z",
"MachineID": null,
"LastUpdateTimeUtc": null,
"ComputerDNSName": null,
"Requestor": "2f48b784-5da5-4e61-9957-012d2630f1e4",
"RelatedFileInfo": {
"FileIdentifier": null,
"FileIdentifierType": null
},
"Scope": null,
"Type": "Unisolate",
"ID": "7e7cae42-6e9b-41a2-be6a-69817ec077a6",
"RequestorComment": "XSOAR - related incident ab57e22c-ad03-4aba-8b6c-b42bd895a116"
}
}
}
Human Readable Output
Results Summary
| Instance | Command | Result | Comment |
|---|---|---|---|
| CrowdstrikeFalcon: CrowdstrikeFalcon_instance_1 | command: cs-falcon-lift-host-containment args: ids: 15dbb9d8f06b45fe9f61eb46e829d986,046761c46ec84f40b27b6f79ce7cd32c |
Success | |
| Cortex XDR - IR: Cortex XDR - IR_instance_1_copy | command: xdr-unisolate-endpoint args: endpoint_id: 15dbb9d8f06b45fe9f61eb46e829d986 |
Error | Error: Endpoint 1dbb9d8f06b4fe9f61eb46e829d986 was not found |
| Cortex XDR - IR: Cortex XDR - IR_instance_1 | command: xdr-unisolate-endpoint args: endpoint_id: 15dbb9d8f06b45fe9f61eb46e829d986 |
Error | Error: Endpoint 1dbb9d8f06b4fe9f61eb46e829d986 was not found |
| Cortex XDR - IR: Cortex XDR - IR_instance_1_copy | command: xdr-unisolate-endpoint args: endpoint_id: 046761c46ec84f40b27b6f79ce7cd32c |
Error | Error: Endpoint 046761c46ec84f40b27b6f79ce7cd32c was not found |
| Cortex XDR - IR: Cortex XDR - IR_instance_1 | command: xdr-unisolate-endpoint args: endpoint_id: 046761c46ec84f40b27b6f79ce7cd32c |
Error | Error: Endpoint 046761c46ec84f40b27b6f79ce7cd32c was not found |
| Microsoft Defender Advanced Threat Protection: Microsoft Defender Advanced Threat Protection_instance_1 | command: microsoft-atp-unisolate-machine args: machine_id: 15dbb9d8f06b45fe9f61eb46e829d986,046761c46ec84f40b27b6f79ce7cd32c comment: XSOAR - related incident ab57e22c-ad03-4aba-8b6c-b42bd895a116 |
Error | Microsoft Defender ATP The command was failed with the errors: {‘15dbb9d8f06b45fe9f61eb46e829d986’: NotFoundError({‘error’: {‘code’: ‘ResourceNotFound’, ‘message’: ‘Machine 15dbb9d8f06b45fe9f61eb46e829d986 was not found. OrgId: b7df6ab7-5c73-4e13-8cd3-82e1f3d849ed.’, ‘target’: ‘9b321da9-6458-4ab3-a818-92f33247508a’}}), ‘046761c46ec84f40b27b6f79ce7cd32c’: NotFoundError({‘error’: {‘code’: ‘ResourceNotFound’, ‘message’: ‘Machine 046761c46ec84f40b27b6f79ce7cd32c was not found. OrgId: b7df6ab7-5c73-4e13-8cd3-82e1f3d849ed.’, ‘target’: ‘d3d4f57f-73a2-4905-bd35-13eccbcaedb6’}})} |
Containment has been lift off host ‘15dbb9d8f06b45fe9f61eb46e829d986’, ‘046761c46ec84f40b27b6f79ce7cd32c’
"""Base Script for Cortex XSOAR - Unit Tests file Pytest Unit Tests: all funcion names must start with "test_" More details: https://xsoar.pan.dev/docs/integrations/unit-testing """ import pytest @pytest.mark.parametrize("action", ["isolate", "unisolate"]) def test_create_command_executers(mocker, action): """ Given: the action to perform (allow or block) When: Calling `create_command_wrappers` to get all the command wrappers for the script. Then: Ensure the right commands wrappers are being returned. """ from IsolationAssetWrapper import CROWDSTRIKE_ACTIONS, MSDE_ACTIONS, XDR_ACTIONS, create_commands, demisto device_ids = ["device1", "device2", "device3"] mocker.patch.object(demisto, "incident", return_value={"id": 1}) msde_command, msde_args = MSDE_ACTIONS[action] msde_args.update({"using-brand": "Microsoft Defender Advanced Threat Protection"}) commands = create_commands(device_ids, action) assert len(commands) == 3 for command in commands: command_names = set(command.commands) if msde_command in command_names: assert command.commands == [msde_command] assert command.args_lst == [msde_args] if XDR_ACTIONS.get(action) in command_names: assert len(command.commands) == len(device_ids) assert len(command.args_lst) == len(device_ids) assert set(command.commands) == {XDR_ACTIONS.get(action)} assert command.args_lst == [{"endpoint_id": device_id} for device_id in device_ids] if CROWDSTRIKE_ACTIONS.get(action) in command_names: assert command.commands == [CROWDSTRIKE_ACTIONS.get(action)] assert command.args_lst == [{"ids": ",".join(device_ids)}]